That's a damn good question.
Basically, one day, my phone started getting lit up with SMS messages from Coinbase about activity on my account, and when I logged in everything had been liquidated and transferred out. I even had money wired from my bank account to Coinbase.
I had 2-factor auth set up, but somehow someone somewhere was able to bypass it all. Contacting Coinbase support they claimed my email account had been hacked. However, I proved beyond a shadow of a doubt that no one had accessed my email account other than myself. They still insisted that it had been hacked.
My conclusion is that they had a nefarious employee that was able to work around their system. That's the only explanation I can think of. My phone, email, etc. were never accessed by anyone but myself.
Bottom line: do not use Coinbase. They are a shit operation and will use any excuse in the book not to help you.